CVE-2023-46298

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via that CDN.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/vercel/next.js/compare/v13.4.20-canary.12...v13.4.20-canary.13Product
https://github.com/vercel/next.js/issues/45301Exploit, Issue Tracking, Third Party Advisory
https://github.com/vercel/next.js/pull/54732Issue Tracking, Patch
https://github.com/vercel/next.js/compare/v13.4.20-canary.12...v13.4.20-canary.13Product
https://github.com/vercel/next.js/issues/45301Exploit, Issue Tracking, Third Party Advisory
https://github.com/vercel/next.js/pull/54732Issue Tracking, Patch

Timeline

Published: Oct 22, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-46304.3An issue has been discovered in GitLab affecting all versions starting from 10.6 before 16.1.5, all versions starting from 16.2 before 16.2.CVE-2023-463009.8iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain escape sequences related to tmux integratio CVE-2023-463019.8iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain escape sequences related to upload.CVE-2023-463029.8Apache Software Foundation Apache Submarine has a bug when serializing against yaml. The bug is caused by snakeyaml https://nvd.nist.gov/vu CVE-2023-463037.5link_to_local_path in ebooks/conversion/plugins/html_input.py in calibre before 6.19.0 can, by default, add resources outside of the documen CVE-2023-463048.1modules/Users/models/Module.php in Vtiger CRM 7.5.0 allows a remote authenticated attacker to run arbitrary PHP code because an unprotected CVE-2023-463066.6The web administration interface in NetModule Router Software (NRSW) 4.6 before 4.6.0.106 and 4.8 before 4.8.0.101 executes an OS command co CVE-2023-463077.5An issue was discovered in server.js in etcd-browser 87ae63d75260. By supplying a /../../../ Directory Traversal input to the URL's GET requ CVE-2023-463089.8In Plotly plotly.js before 2.25.2, plot API calls have a risk of __proto__ being polluted in expandObjectPaths or nestedProperty.CVE-2023-463097.3Missing Authorization vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Exploiting Incorrectly Configured Access Control Security Lev CVE-2023-46315.3The DoLogin Security WordPress plugin before 3.7 uses headers such as the X-Forwarded-For to retrieve the IP address of the request, which c CVE-2023-463106.1Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in gVectors Team wpDiscuz allows Code Injection.